Design D-003, Phase 2A: not a claim of a deployed end-to-end transaction.
Intended sequence
- Commerce authenticates and persists an immutable purchase command, leaving the order pending.
- One authorized Executor claims that command under appropriate fencing.
- Executor revalidates live provider terms; browse cache is never purchase authorization.
- Wallet reserves an atomic, exact-command hold in its append-only ledger.
- Executor commits a unique, durable dispatch intent before any Provider POST.
- Provider adapter checks scoped purchase identity and performs only the authorized operation.
- Commerce and Wallet apply verified outcome evidence idempotently.
Failure rules
| Failure window | Safe outcome |
|---|---|
| Admission before claim | Resume safe pre-effect work |
| Wallet hold acknowledgement lost | Query exact original hold; no guessed second debit |
| Dispatch intent commit uncertain | Read recorded intent before proceeding |
| Provider POST timed out | Unknown outcome; do not submit again |
| Definitive failure proved | Owning services reconcile and release safely |
| Wrong caller, capability or version | Fail closed before external effect |
An uncertain request is neither a definitive failure nor a proven purchase. Upstream idempotency and readback must be demonstrated independently.
Ownership
Commerce owns admission and orders; Wallet owns ledger and holds; Executor owns dispatch; provider data plane owns scoped upstream calls. Integration, security and rollback gates remain unverified.